Claude Mythos Is Coming to Everyone in Weeks. Harden Your Network Before It Does.

I do not write posts like this often, because crying wolf is the fastest way to get tuned out. So read this one carefully. Something shifted in the security world last month, and the window to get ahead of it is measured in weeks, not quarters.

On April 7, 2026, Anthropic unveiled a model called Claude Mythos. They did not release it to the public. They handed a preview to roughly 50 vetted defensive-security partners under a program called Project Glasswing, names you would recognize: Microsoft, Apple, Cisco, CrowdStrike, Palo Alto Networks, Broadcom, the Linux Foundation, Amazon. Anthropic backed it with up to $100 million in usage credits and another $4 million to open-source security groups. When a company gives away that much access but keeps the model locked behind vetting, it is telling you the capability is serious.

Here is what serious looks like. In testing, Mythos autonomously discovered thousands of high-severity zero-day vulnerabilities across every major operating system and every major web browser. In Mozilla Firefox alone it found 271 vulnerabilities and built working exploits for 181 of them. Some of those flaws had survived decades of human review and millions of automated tests. A machine just read the code and understood what the humans missed.

What actually changed

Vulnerability scanners are not new. The difference is intent and reach. Mythos does not just match patterns against a list of known bugs. It reads code the way a senior engineer does, understands what the code is trying to do, and finds the gap between intent and reality from a plain-English instruction. Then it does the parts that used to require a whole team of specialists.

It chains small, individually harmless weaknesses into one devastating attack. It can reconstruct source code from software that is already deployed, so "nobody has our code" stops being a defense. And in the scenario that should keep every business owner up at night: once it is inside a network, it maps your systems, moves laterally from machine to machine, builds custom tools on the fly, and exfiltrates data within hours. Anthropic reported that engineers with no security background produced complete, working exploits overnight.

I want to be fair here, because the honest version is more useful than the scary one. Several security experts, including voices quoted by CNBC, have pushed back on the hype. Their argument: most of what Mythos demonstrates was already achievable with older models and skilled operators. This is an acceleration of a trend, not a brand-new category of threat. I think they are right, and that is exactly why I am writing. What Mythos changes is the price and the speed. Capability that used to take an expert and a lot of time now takes a prompt and a few hours. Cheaper, faster, and more accessible means more people can do it, and your defenders' timelines just got compressed.

The part that makes this urgent

On May 28 and 29, alongside the launch of Claude Opus 4.8, Anthropic said it had made swift progress on safeguards and plans to make a Mythos-class model available to all customers in the coming weeks. No exact date. They are also raising money at a record valuation and expanding Project Glasswing to include US and allied governments.

Read that plainly. Right now this power sits with vetted defenders. In a matter of weeks, a comparable capability becomes broadly available, and whatever the good guys can buy off the shelf, the bad guys can rent too. The takeaway is not that the sky falls tomorrow. It is that the gap between "only a few experts can do this" and "anyone can do this" is closing, and the smart move is to shrink your exposure before the crowd shows up, not after your name is in a breach notification. Defenders are getting these tools first. That is the opening. Use it.

Harden now: the checklist

None of this is exotic. It is the unglamorous work that decides whether an automated attack bounces off you or walks right in. An attacker with Mythos-class tooling will find the one server you forgot to patch and the one account without MFA faster than ever before. Close the easy doors first.

• Patch aggressively. Every unpatched system is a known door. Mythos is brutal at exploiting the flaws you already could have fixed. Get a real patch cadence for operating systems, browsers, and third-party apps.
• Shrink your exposed surface. Inventory every service facing the internet: remote desktop, VPNs, web apps, management consoles. Anything that does not need to be public should not be.
• Turn on MFA everywhere. Email, VPN, admin accounts, cloud apps, all of it. A reconstructed exploit chain still stalls at a second factor you control.
• Segment your network. The danger is lateral movement. If a foothold in reception cannot reach your servers, you have contained the blast radius.
• Deploy and monitor EDR. Endpoint detection and response catches the build-tools-and-move-fast behavior these attacks rely on. It has to be watched, not just installed.
• Test your backups. Offline, immutable, and actually restored in a drill. A backup you have never tested is a hope, not a plan.
• Write the incident plan before you need it. Who you call, who decides, how you communicate, in what order. Hours matter when an attack moves in hours.

Talk to us before the public release, not after the first incident

This is the rare moment where being early actually pays. The capability is real, the timeline is short, and the defensive work is known and doable. G8 can audit your environment, find the exposed services and missing patches and weak access controls, and shrink your attack surface while you still have a head start. That audit is far cheaper than recovery, and the calendar is not on our side.

If you run a business in our area, contact G8 this week. Let us look at your attack surface and tighten it before a Mythos-class model is in everyone's hands. The companies that move now are the ones who will read the headlines instead of starring in them.

Reach out today. The clock started in April, and it is running faster than usual.

Adam, G8 IT